Re: [gentoo-nfp] Gentoo Social Contract and potential liabilities

[Alec Warner]

On Sun, Oct 25, 2015 at 12:51 AM, Sven Vermeulen <swift@g.o> wrote:

> On Sat, Oct 24, 2015 at 09:18:02AM -0400, Rich Freeman wrote:
> > On Sat, Oct 24, 2015 at 8:33 AM, Sven Vermeulen <swift@g.o>
> wrote:
> > >
> > > This was brought forward when we started accepting user contributions
> > > through GitHub. Yes, we've had the discussion that we don't depend on
> it.
> > > But now the question was how do we need to interpret "depend on"?
> > >
> >
> > The Council took up this topic last week.  I'm not suggesting the
> > Trustees are bound by this, but they certainly should be informed by
> > it.  What we agreed upon was:
> >
> > "The Gentoo council encourages contributions to Gentoo via manyfold
> > ways. However, it also recognizes that the usage of Github, being a
> > closed-source service, poses the danger of data lock-in and should not
> > be preferred. The question has been posed whether the current usage of
> > Github is in line with the Gentoo social contract- a question still
> > open to interpretation.
> > With this background the council asks for implementation of
> > * the two-way mirroring of Github pull requests to bugzilla (including
> >   comments and patches)
> > * the public archiving of Github repository e-mail notifications
> > * and the mirroring of Github pull request git branches on Gentoo
> >   infrastructure
> > or functionally equivalent alternatives. The council believes that
> > this should suffice for all developers to dispell doubts about
> > adherence to the Gentoo social contract."
>
> This, and the remainder of the discussion in this thread, already assumes
> that there is a dependency applicable. There is still the strict
> interpretation of that paragraph, which somewhat excludes services (it
> being
> about the release of our contributions, or the collection of software and
> documentation that constitutes Gentoo).


>
> People can also interpret it that it includes services, in which case we
> should
> know if "dependence" is in a terminal sense (without it, we can't survive)
> or in other degrees of dependency (losing functionality, or just losing
> performance). Right now, services such as those that GitHub provides are
> not
> a hard dependency. If GitHub closes its doors suddenly, we will not lose
> functionality, merely some performance in one of our contributing
> processes.
>

I think it is informative to know what 'people' think (because perception
has value) but I'm not sure I actually care so much as to be driven to
action by 'what people think.' "People' can often think whatever they like,
that doesn't mean we need to act. Does that make sense?


> That is not something I personally see as being dependent upon. But that is
> how I feel when I see the term "depend on". It's a language construction,
> not a mathematically defined statement, so I definitely understand if
> people
> read "depend on" as in "there is a relationship between the two".
>
> So the other discussions are to be seen in the "worst case", which even
> then
> is not a final end. Our "Social Contract" has been written with a specific
> purpose in mind. It is an attempt to write down the principles in a
> readable
> and clear way. Like always, language interpretations can occur. If we
> notice
> that the interpretation of the text is not in line with our principles then
> we should start the process of making our principles more clear.
>
>
I think revising the language to better align the "contract" with our
actual intentions seems like a fine idea.


> That then starts with finding consensus from the Gentoo Project on how they
> want to evolve. Are the principles of "Gentoo is and will remain Free
> Software" in jeopardy or not? In what way would we need to either refine
> the
> contract, or provide a FAQ document alongside the contract that explains
> how
> we feel about specific interpretations (or more specifically, the
> relationship we would have with external services)?
>
>
I'm a bit unclear here, is the decider here trustees@ or council@? Or are
we willing to simply let the project decide on their own with limited
trustee oversight (e.g. the contract should not advocate for any behavior
that imposes legal risk on the foundation.) Who is driving such changes?


> I deliberately did not include this in the thread (i.e. I did not ask
> "Do you consider external services as being part of Gentoo" and
> "When do you feel Gentoo depends on an external service") as I think first
> we need to know if there is ground to do this or not.
>
> Wkr,
>         Sven Vermeulen
>
>